Security
Anyone can write “bank-grade security”. This page instead describes what actually stops a specific bad thing from happening to you — and, in each case, where that protection stops.
Escrow locks before you pay
The seller’s USDT leaves their spendable balance before you are shown any bank details. You never pay against an order that is not already funded.
Two destinations, never three
Locked USDT can only be released to the buyer or returned to the seller. There is one code path for each, and an order can take only one of them, only once.
Double-entry ledger
Every movement is a balanced pair of entries under one transaction id. Your balance is calculated from that history, never stored as a number someone can edit.
Append-only financial history
Ledger entries, order events and audit logs reject UPDATE and DELETE at the database level. A mistake is corrected by posting a reversing entry, which leaves both records visible.
24-hour withdrawal address cooldown
A newly added withdrawal address cannot be used for 24 hours. If someone takes over your account, that delay is your chance to notice and stop them.
The app never holds a private key
It asks a custody provider to send funds. There is no signing function in the application, so there is no key for an attacker or a log file to leak.
Escrow: the only two places your USDT can go
When a trade starts, the seller’s USDT is moved out of their spendable balance into a platform escrow account. This happens before the buyer is shown any bank details. From that moment the seller cannot spend it, withdraw it, or sell it to someone else.
The important part is what happens next. Locked USDT has exactly two possible destinations, and the software has exactly one route to each:
| Outcome | Trigger | Detail |
|---|---|---|
| Released to the buyer | Payment confirmed | Or a dispute decided in the buyer’s favour. |
| Returned to the seller | Expired or cancelled | Automatic on expiry. Or a dispute decided for the seller. |
There is no third outcome. An order cannot release twice, release to both sides, or leave money stranded — the outcome is derived from the order transition itself, so no piece of code can release funds on a step that was only meant to change a status.
Where escrow stops
Escrow removes one risk: the seller taking your rupees and vanishing with the coin. It does not protect you from sending money to the wrong bank account, from someone persuading you to trade outside the platform, or from the price of USDT moving. If a trade happens off-platform there is no escrow, no evidence trail and no dispute — and nothing we can do for you afterwards.
Your balance is a calculation, not a number in a box
Double-entry
Money never simply appears or disappears. Every movement is recorded as a balanced pair of entries — one account debited, another credited by the same amount — grouped under a single transaction id. If the two sides of a movement do not agree, the transaction is rejected rather than written.
This is the same method banks and accountants have used for centuries, and it exists for one reason: an error cannot hide. A missing rupee is a transaction that does not balance, and it shows up immediately.
Append-only
Financial history cannot be rewritten. The ledger entries table, the order events table and the audit log all reject UPDATE and DELETE at the database level — not in the application, where a bug or a compromised service could bypass the check, but in the database itself, which refuses the write outright.
So a mistake is not erased. It is corrected by posting a new, reversing entry, and both the original and the correction stay visible in your history. If you ever want to know why a balance changed, the answer exists and cannot have been quietly edited.
Reconciled
What the ledger says the platform owes its customers is checked against what custody records say the platform actually holds. A difference is an alarm, not a rounding question.
Getting money out is the part we make deliberately slow
Most people who lose crypto do not lose it in a trade. They lose it because someone got into their account and emptied it to an address they had never seen. Three things sit in the way of that.
A 24-hour cooldown on every new withdrawal address
When you save a new USDT withdrawal address, it cannot be used for 24 hours. If an attacker takes over your session, they cannot add their own address and drain the account in the same sitting — that delay is the window in which you notice, change your password, and stop them.
It is inconvenient exactly once. Add the addresses you expect to use before you need them. (The cooldown is a platform setting; 24 hours is the current value.)
Two-factor authentication on sensitive actions
Two-factor authentication uses TOTP — the six-digit rolling code from an authenticator app such as Google Authenticator. When it is switched on, a withdrawal request will not proceed without a valid code, so a stolen password alone is not enough. You also get eight one-time backup codes at setup; each works once, for the day you lose your phone. Store them somewhere other than your phone.
Rupee payouts only to accounts in your own name
Rupees can only be sent to a bank or mobile account you have saved and verified as yours. We will not pay a third party. That is a regulatory requirement, and it is also why a compromised account cannot be emptied into a stranger’s bank.
The application never holds a private key
A private key is the secret that authorises moving crypto. Whoever holds it controls the funds. Most exchange collapses trace back to how badly that key was handled.
This platform does not have one. There is no function anywhere in the application that signs a blockchain transaction. Instead the software asks a custody provider to send an amount to an address, and the provider holds and uses the key material. The application cannot leak, log or misuse a key it never receives.
Where this platform currently stands
The chain integration runs against a sandbox custody provider outside production. Until a live provider is configured, on-chain deposits and withdrawals do not move real funds. Internal balances, trades between customers and rupee payouts are unaffected. We would rather tell you this plainly than let you assume otherwise.
Who inside the platform can do what
Staff access is separated by job. Support staff can read a trade and talk to you; they cannot move funds. Releasing escrow during a dispute is a separate permission, it demands a written reason, and it is recorded in an audit log that — like the ledger — cannot be edited or deleted afterwards.
Identity documents are stored encrypted and are visible only to reviewers holding the specific permission to see them. Every access is written to the audit trail with the reviewer’s identity. Operational screens elsewhere in the platform show masked identifiers rather than full documents by default.
What we will never do
We will never ask for your password, your two-factor code, or your backup codes. Nobody from Meridian needs them, and anyone who asks is not from Meridian.
We will never ask you to send funds to an address or a bank account given to you over chat, email, WhatsApp or a phone call. Payment details for a trade appear inside that trade in the app, and nowhere else. If the details you were given came from anywhere else, stop.
We will never ask you to complete a trade outside the platform, and we will never promise you a guaranteed return.
If something has gone wrong
If you think someone has accessed your account: change your password immediately, turn on two-factor authentication if it is not already on, and contact us straight away. Speed matters — the address cooldown only helps if somebody uses it.
If your problem is a specific trade, open that trade and use its chat. Support can see the escrow, the payment evidence and the full timeline there, which resolves things far faster than an email can.
If you have found a security vulnerability, please report it to us privately before disclosing it publicly, and give us a reasonable window to fix it. We would much rather hear it from you.
Ready to start?
Verify your email and phone to buy. Selling needs a completed identity check.